SQL Injection · passage 45 of 186

DB2 Injection: DB2 Blind Based

Text · SQL Injection/DB2 Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

| Description | SQL Query | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Substring | `select substr('abc',2,1) FROM sysibm.sysdummy1` | | ASCII value | `select chr(65) from sysibm.sysdummy1` | | CHAR to ASCII | `select ascii('A') from sysibm.sysdummy1` | | Select Nth Row | `select name from (select * from sysibm.systables order by name asc fetch first N rows only) order by name desc fetch first row only` | | Bitwise AND | `select bitand(1,0) from sysibm.sysdummy1` | | Bitwise AND NOT | `select bitandnot(1,0) from sysibm.sysdummy1` | | Bitwise OR | `select bitor(1,0) from sysibm.sysdummy1` | | Bitwise XOR | `select bitxor(1,0) from sysibm.sysdummy1` | | Bitwise NOT | `select bitnot(1,0) from sysibm.sysdummy1` |

Every one of the 186 is a mark on the map. Named now: 27 to 52, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.